v2026.8.1

Adds three product surfaces to the reference — cPanel hosting, Mailspace mail
hosting (buying one and managing everything inside it), and a WordPress site's
transactional email — plus backup exports, and corrects reference content that
shipped in 2026.8.0.

API reference verified against CloudPress platform release 2026.08.01.

This release documents platform release 2026.08.01, which is not yet live. The
cPanel, Mailspace and transactional-email endpoints, the three new OAuth scopes, and
the missing_account and domain_availability_unknown error codes all ship with it.
Everything else below is already in production.

Nothing was published between 2026.8.0 and this release, so if you are upgrading, you
are getting all of the below in one step.

Added

• cPanel hosting (reference/endpoints-cpanel.md, new). Account list/show,
  ordering, package resizes, cancellation, immediate purge, control-panel
  password changes, one-time control-panel login sessions, and per-account domain
  management (aliases, subdomains, add-on domains) with the per-kind usage and
  limit counters. Includes the availability gate (cpanel_not_enabled), the
  full error-code table per endpoint, the 500-account listing ceiling, and the
  role each operation requires — evaluated on the owning account, not on
  X-Auth-Account.
• Mailspace mail hosting (reference/endpoints-orders.md). Purchase, resize,
  soft-delete, the domain-ownership TXT verification block, and the hold
  semantics that edit access does not override.
• Mailspace mail management — three new reference files, ~61 endpoints, all on the
  mailspace:read / mailspace:write scopes above:
  • reference/endpoints-mailboxes.md — mailboxes (keyed by guid, not address),
    app passwords, mail rules (including toggle, move and adopt), vacation
    responses, purged-mailbox recovery, and archived deleted mail. Covers the
    irreversible force_delete and its 409 not_pending_deletion precondition, and the
    download route, which returns raw message/rfc822 rather than JSON.
  • reference/endpoints-mail-routing.md — aliases (keyed by address), groups and
    mailing lists (keyed by the mail server's principal id), masked emails, and the
    delivery-logs endpoint. GET /groups has two 503s and the code says which read
    failed: groups_unavailable for the group list, group_members_unavailable for the
    member tally alone. The q filter matches the address and the description on both
    groups and mailing lists — the same two fields, with the same predicate. The logs endpoint returns incoming, outgoing, queue and
    issues under separate keys because they have different upstream availability —
    documented so that "trace data not licensed" stays distinguishable from "no mail
    problems".
  • reference/endpoints-mailspace.md — mail domains and their required DNS records,
    both ownership-verification surfaces (the primary domain's runs before
    provisioning), and the permanent purge. PATCH .../domains/:name treats
    description as three-way: omit the key to leave it untouched, send "" to clear
    it, send a value to set it. DNS record values are returned live in the
    response and the file says to publish them verbatim rather than hardcoding them.
• Transactional site email (reference/endpoints-sites.md) — overview, sender
  settings, suspension, sender-DNS check, send logs, and mail metrics at
  /api/sites/:site_id/mail. Two behaviours that the HTTP verb actively misleads on:
  the suspension endpoint is a DELETE that lifts a hold, and the overview mounts at
  /mail with no /overview segment.
• Backup exports (reference/endpoints-sites.md). Request an archive export
  and poll for the short-lived presigned download URL, including why both the
  request and the status read are gated as sites:write.
• Three OAuth scopes: mailspace:read, mailspace:write, and cpanel:read.
  Documented alongside the fact that there is deliberately no cpanel:write —
  every cPanel write is OAuth-blocked and needs a session or API-key credential.
  Two consequences are called out explicitly, because neither is obvious from the scope
  name:
  • They spend money. mailspace:write and sites:write each reach an endpoint that
    builds a cart and charges the account off-session, so an OAuth token holding either
    can spend money. This does not generalise from the absence of a billing:write.
  • mailspace:* reaches mail itself, not just subscription metadata.
    mailspace:read reads delivery logs and downloads raw archived messages;
    mailspace:write reaches mailbox force-delete and the immediate purge of a
    soft-deleted mailspace. There is no narrower mail scope to request instead.
• The gate chain for everything nested under /api/mailspace/:id — the order, the
  code for each (stalwart_unavailable 503, not_authorized 403, mailspace_suspended
  403, pending_delete 403, not_provisioned 409), and which are decided on the HTTP
  verb rather than the action name. not_authorized and pending_delete are verb-gated,
  so reads stay available on a soft-deleted mailspace; mailspace_suspended is not,
  and refuses reads too despite a message saying "cannot be modified". Two deliberate
  exceptions: purge does not apply pending_delete (soft-deleted is its precondition) and
  primary-domain verification does not apply not_provisioned.
• The mailspace read-failure convention, documented as a cross-cutting rule. Every
  index inside a mailspace reads the mail server live, and a read that could not be
  performed answers 503 under a per-resource code — mailboxes_unavailable,
  domains_unavailable, aliases_unavailable, groups_unavailable,
  mailing_lists_unavailable, archived_items_unavailable,
  purged_mailboxes_unavailable — rather than a 200 carrying an empty collection. The
  consequence is the reason it is in SKILL.md rather than only per endpoint: an empty
  array on those endpoints means the mail server was asked, so a client may reconcile its
  own state against it. It is honesty about the read, not completeness — the 500-row caps
  still truncate silently, and purged_mailboxes applies its cap server-wide before tenant
  filtering, so an empty list there is still not proof the mail is gone. The exceptions are
  enumerated rather than left to inference — mail rules answer
  422 mail_rules_unavailable, and the app-password list, masked emails, delivery logs and
  the by-id group / mailing-list lookups are still tolerant.
• 503 on a mailspace write answers one of two opposite questions, and the skill
  now says which per code. restore_unavailable (purged-mailbox restore) and
  archived_item_lookup_unavailable mean nothing was attempted. restore_unconfirmed
  and delete_unconfirmed (archived mail) and aliases_unavailable on an alias write
  mean the request went out and its fate is unknown — re-read before retrying, and
  especially so for delete_unconfirmed, where the erase is irreversible.
  delete_unavailable on mailbox force-delete is a third case: the mailbox is gone and
  what could not be established is whether its mail is still recoverable. A 422 is the
  only answer that means the mail server replied and refused.
• New codes and async shapes on the mail surface: 400 invalid_days (a non-numeric
  days on mail metrics), 409 already_provisioned (a verification retry on a mailspace
  already set up), 409 not_recoverable covering the terminal "the mail server has
  already erased this account" branch of a purged-mailbox restore (so 422 restore_failed
  means only that the server refused, and is retryable), 503
archived_item_lookup_unavailable, restore_unconfirmed and delete_unconfirmed on
  the archived-mail by-id routes, and two 202 shapes: the primary-domain verification
  returns the verification block (poll the same path until state is "provisioned"),
  and the site mail DNS check returns {"status":"queued"} with nothing to poll. Also:
  download_unavailable on an archived-mail download carries two statuses — 404
  when the mail server answered that the message is gone (terminal), 503 for any other
  read failure (retriable) — and X-Auth-Account is not required on the nested
  mailspace routes even though POST /api/mailspace requires it.
• list_site_tasks MCP tool (66 tools total), with the pagination difference
  from its REST counterpart called out.
• cPanel billing webhooks (reference/webhooks.md). A third outbound payload
  block, cpanel_account_link, with created / resized / owner_change /
  deleted. Because action strings are reused across resource kinds, the file
  now says explicitly: route on the resource block, never on action alone.

Changed

• Task labels are redacted and performed_by is masked. Keys beginning
  callback_ are stripped, so a callback URL and its Authorization value can
  never be read back from a task. Platform automation reports
  {id: null, name: "System"} and CloudPress staff {id: null, name: "Support"}
  — a null performed_by.id is meaningful, not missing data. Applies to the REST
  endpoints and the MCP tool alike.
• POST /api/sites/:site_id/domains documented as "connect a domain." It
  attaches the domain as the site's primary only when the site has none, and as an
  alias otherwise. Adds the replace_records parameter and the four error codes
  the endpoint now returns (domain_blank, conflicts_found — which carries a
  conflicts array — hostname_in_use, invalid_domain).
• DNS writes state their role gates. Zone update requires edit access and
  zone delete requires destroy access (both 403 forbidden), as do record
  create, update and delete.
• 400 missing_account accompanies the Missing X-Auth-Account error body on
  the endpoints that enforce the header — the list is enumerated in SKILL.md,
  and POST /api/dns_zones is a deliberate exception that returns the same
  message with no code key. Per-site task 404s carry code: "unknown_task";
  the global task endpoints return an empty 404 body instead.
• 429 no longer always means an empty body. 2026.8.0 documented the rate-limit
  response as empty; that is true of the global 600-per-10-minutes limit, but two
  per-endpoint DNS-check limiters (one run per 5 minutes) return
  {"errors":[...],"code":"rate_limited"} — the mailspace DNS check per domain, and the
  site mail DNS check per site, which shares its limiter with the control panel.

Fixed

• Corrections to reference content that shipped in 2026.8.0. Every page was
  re-derived against the platform source; the following were wrong before and are
  worth checking if you built against them:
  • POST /api/sites/:site_id/domains/request_certificate never had a wildcard
    parameter, and the certificate status response has no wildcard field.
    Wildcard certificates are not supported by that flow.
  • The domain availability check returns the registration price as price,
    not create_price.
  • The CDN metrics response keys the cache hit rate as CacheHitRate, not
    CacheHitRatio. Its bandwidth figures are raw bytes — the control panel's
    KB conversion and hit-rate rounding are not applied to the API response.
  • Shield activation reports a missing pull zone as shield_not_active;
    cdn_not_active never appears anywhere in the Shield path.
  • POST /api/sites/:site_id/metrics/* and POST /api/sites/:site_id/metrics/cdn
    require site edit permission in addition to sites:read.
  • The rate limit is keyed per client IP and counted per resource group,
    not per credential across all of /api.
  • Example values that did not correspond to anything real have been replaced
    throughout — nameserver hostnames (never hardcode them; read the pair from the
    response), Mailspace package keys, location and plan identifiers, and example
    domains. A site's package field carries the product display name; the
    short name is what requests take.
  • 202 responses do not uniformly carry a task reference. The complete set
    of 202 shapes is now enumerated in SKILL.md.
  • Index endpoints do not uniformly paginate; the five that do are named.
• 422 domain_availability_unknown on domain orders. A failed availability
  check is no longer reported as domain_unavailable. The distinction matters:
  one is a claim that the name is taken, the other is no claim at all and should
  be retried rather than shown to a customer as unavailable.

---

Install for Claude Code with /plugin marketplace add cloud-press/skills,
or for Cursor, Codex, opencode and other agents with npx @cloud-press/skills.
The attached zip is for uploading the skill to claude.ai or Claude Desktop.